{"action":"Upgrade passport to 0.6.0 or later.","affected":[{"fixed":"0.6.0","introduced":"0"}],"component":"passport","cve_ids":["CVE-2022-25896"],"ecosystem":"npm","epss":0.01116,"exploited":false,"fixed_versions":["0.6.0"],"ghsa_id":"GHSA-v923-w3x8-wh69","id":"tcs_01M5KGBBQN0NGFZH5Q2YZH8WC4","modified_at":"2026-07-08T06:49:59.642295037Z","published_at":"2022-07-02T00:00:19Z","references":["https://osv.dev/vulnerability/GHSA-v923-w3x8-wh69","https://nvd.nist.gov/vuln/detail/CVE-2022-25896","https://github.com/jaredhanson/passport/pull/900","https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608","https://github.com/jaredhanson/passport","https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-v923-w3x8-wh69","url":"https://osv.dev/vulnerability/GHSA-v923-w3x8-wh69"}],"summary":"Passport vulnerable to session regeneration when a users logs in or out"}